VULNERABILITY INTELLIGENCE
CVE-2026-77144
EPSS probability0.41%
CISA KEVNot currently listed
Published2026-08-25
Last modified2026-09-28
Description
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.
Weakness classification
- f4fb688c-4412-4426-b4b8-421ecf27b14a: CWE-915